VQL Reference Event Plugins watch_usn watch_usn Plugin Arg Description Type device The device file to open (as an NTFS device). string (required) Description Watch the USN journal from a device.